4220000.arrivehelp.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	4220000.arrivehelp.dll
size	296960 (0x48800)
md5	04853b9bcbd255d4160d9989b8457272

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
123	50727	4
1	0	43
93	4035	3
137	21022	17
146	21022	1
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x5e16488c
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xc00
SizeOfInitializedData	0xc00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x16b7
BaseOfCode	0x1000
BaseOfData	0x2000
ImageBase	0x4220000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x4c000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x400
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xab3	0xc00	R-X CODE
.rdata	0x2000	0x3bc	0x400	R-- IDATA
.data	0x3000	0x280	0x200	RW- IDATA
.bss	0x4000	0x28	0x200	RW- IDATA
.reloc	0x5000	0x47000	0x47000	R-- IDATA

Data Directory

type	va	size
EXPORT	0x2370	0x4c
IMPORT	0x20d0	0x50
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x5000	0x80
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2000	0x78
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
ntdll.dll	1352	memset
ntdll.dll	1350	memcpy
KERNEL32.dll	1070	TerminateThread
KERNEL32.dll	704	InterlockedIncrement
KERNEL32.dll	700	InterlockedDecrement
KERNEL32.dll	1124	WaitForSingleObject
KERNEL32.dll	671	HeapCreate
KERNEL32.dll	1057	Sleep
KERNEL32.dll	486	GetLastError
KERNEL32.dll	544	GetProcAddress
KERNEL32.dll	1114	VirtualProtect
KERNEL32.dll	120	CreateFileA
KERNEL32.dll	1165	WriteFile
KERNEL32.dll	872	ReadFile
KERNEL32.dll	136	CreateMailslotA
KERNEL32.dll	67	CloseHandle
KERNEL32.dll	426	GetCurrentProcessId
KERNEL32.dll	676	HeapReAlloc
KERNEL32.dll	669	HeapAlloc
KERNEL32.dll	673	HeapFree
KERNEL32.dll	501	GetModuleFileNameW
KERNEL32.dll	1108	VirtualAlloc
KERNEL32.dll	454	GetExitCodeThread
KERNEL32.dll	163	CreateThread
KERNEL32.dll	1205	lstrlenA
KERNEL32.dll	753	LoadLibraryA
USER32.dll	775	wsprintfA

ord	entry_va	function_name
1	0x1360	DllRegisterServer

module_name	crm.dll
flags	0
timestamp	2020-01-08 21:24:28
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x239c
Functions(1)	0x2398
NameOrdinals(1)	0x23a0

show previews

offset	size	type	comment
0	296960	DLL	01/08/2020 21:24:28	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK